What We Know
Market-intelligence platform Klue experienced an OAuth compromise that researchers and reporting say allowed attackers to access customer Salesforce data through Klue’s integrations. Multiple outlets link the incident to a threat group calling itself “Icarus”; RH-ISAC and BleepingComputer reported that Icarus has claimed responsibility and that the breach enabled theft of Salesforce-linked data.
The list of affected Klue customers has expanded as investigations proceed. The Register reported that “hundreds” of Klue customers were impacted and that several cybersecurity firms are among the victims. BleepingComputer framed the event as a supply-chain exploit of Salesforce-connected integrations, and at least one large vendor — LastPass — has publicly confirmed it suffered a data breach connected to the Klue supply-chain incident.
Taken together, the reporting establishes that an OAuth compromise at Klue has been used to harvest Salesforce data from multiple downstream customers, that the extortion-oriented Icarus group is claiming responsibility, and that the roster of affected organizations is still growing.
Source Comparison
Aligned reportingCorroborates
- BleepingComputer↗Reports that a Klue OAuth compromise enabled attackers to access Salesforce-linked customer data, that the Icarus group has claimed the attack, and that the list of victims is growing.
- The Register↗'Reports that "hundreds" of Klue customers were impacted and highlights that several cybersecurity firms are among the victims, corroborating the expanding roster of affected organizations.'
- rhisac.org↗RH-ISAC advisory stating the Icarus threat group claims theft of Salesforce data in the Klue supply-chain breach, aligning with reporting that Icarus has taken responsibility for the incident.